Containerfile: Add a release_type label to control floating tag

[owtaylor]

We currently tag every single build - whether from a tagged release or not as :latest in our Konflux-backed quay.io builds. To allow us to only label tagged releases with the :latest tag add a label to the Containerfile that is latest (for a tagged release) and dev otherwise.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
unittests	97.36% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Jazzcort]

My thought could be wrong. 😆

[Jazzcort]

Shouldn't we just add an entry here to grab the release_type from get version?

- name: ADDITIONAL_TAGS
   value:
     - $(params.additional-tags[*])
     - $(params.tag-prefix)$(tasks.clone-repository.results.short-commit)
     - $(tasks.get-version.results.release_type)

And we delete the entire additional-tags entry from spec.params in push.yaml.

Or I might misunderstand something. 😆

[samdoran]

You're absolutely correct. Good catch!

[samdoran]

This is a lot trickier than it should be. There are two places where the latest tag is applied: 1) in the push pipeline which we directly control and 2) in the release plan admission which we do not directly control (we can pass parameters but cannot define custom tasks):

Excerpt from the release plan admission parameters:

...
  data:
    mapping:
      registrySecret: konflux-release-service-access-management-token
      components:
        - name: linux-mcp-server
          public: true
          pushSourceContainer: false
          repositories:
            - url: quay.io/redhat-services-prod/rhel-lightspeed-tenant/linux-mcp-server
              tags:
                - latest
                - "{{ git_short_sha }}"
                - "{{ labels.version }}"
...

For the push task, we can directly control the labels that get applied by using outputs from custom tasks. But the only way to send data to the release pipeline is through container image labels. We need to remove additional-tags from the push pipeline as @Jazzcort suggested and remove the hard coded value in the release plan admission to use {{ labels.release_type }} (which is in another repo).

That will solve one problem, but what we need is actually a bit more complicated. The latest tag is expected to mean "latest stable release". We should only apply the latest label if the version matching the ref is the latest stable release.

Say we have version 1.y and 2.y released. If we push a new 1.y.z version, it will get the latest label, which is incorrect. That's a future edge case but worth thinking about. I fixed this problem in lightspeed-core. Doing the equivalent in Konflux is possible but would be slightly more complicated.